CVE-2026-72643

Name of the Vulnerable Software and Affected Versions Kibana Agent Builder (affected versions not specified)

Description An incorrect authorization mechanism exists when determining the ownership of a private agent. The system compares a stable user identifier if available, but falls back to comparing the username when it is not. Because usernames are not unique across Elasticsearch authentication realms, two different principals with the same username in different realms are identified as the same owner. This allows an unauthorized caller to view the configuration and instructions of an agent they do not own, as well as modify or delete it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.